GDPR Data Protection

Last updated: October 7, 2026

This page explains how Qrious supports data protection rights under the General Data Protection Regulation (GDPR). It complements our Privacy Policy, which describes the data we process in more detail.

Controller and contact

Qrious is operated by Radulescu D Stefan-Radu PFA, CUI 55429019, and is responsible for the account, QR code, uploaded file, billing status and support data processed through the service. GDPR and privacy requests can be sent to stefan@qrious.now or through the Contact page.

Your rights

• Access a copy of personal data connected to your account.
• Correct inaccurate account or profile information.
• Request deletion of account data where no legal retention duty applies.
• Restrict or object to certain processing where GDPR allows it.
• Request portability of account-related data in a reasonable format.
• Withdraw consent where processing is based on consent.

Data we process

Qrious may process account details, authentication events, QR titles, destinations, uploaded files, design settings, subscription status, contact messages and pseudonymous scan analytics. Raw scanner IP addresses are not stored for QR analytics.

Legal bases

We process data to perform the service contract, protect accounts, prevent abuse, comply with legal and accounting obligations, answer support requests and improve the product through privacy-conscious operational analytics.

Processors

Qrious uses trusted providers such as Supabase for authentication, database and storage, Stripe for payments and subscription management, email delivery providers for transactional messages, Vercel for hosting, and Google Ads for advertising measurement. See the Privacy and Cookie policies for the data and choices associated with these services.

Retention and deletion

Account, QR and uploaded-file data is kept while the account remains active or while needed for service, security, legal or accounting reasons. When deletion is requested, we remove or anonymize eligible data after verifying the request.

Response time

We respond without undue delay and normally within one month of receiving a request. Where legally permitted, complex or numerous requests may require up to two additional months; we explain the extension within the first month.

Complaints

If you believe your data protection rights were not respected, you may contact us first or file a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP).